China Publishes Import License List and Export Control List for Commercial Encryption

Below, we summarize the Encryption Import List, Encryption Export List, and our key observations.

Encryption Import List

The Encryption Import List includes four types of commercial encryption items:

1. encrypted phones;
2. encrypted fax machines;
3. cipher machines (including cipher cards); and
4. encryption VPN devices.

Importers in China must obtain a license from MOFCOM to import the above encryption items.

Encryption Export List

The Encryption Export List includes hardware, software and technology related to the following items:

1. security chips;
2. cipher machine (cipher card);
3. encrypted VPN devices;
4. key management products;
5. special purpose cryptographic devices;
6. quantum cryptographic devices; and
7. cryptanalytic devices;
8. items specifically designed to develop or produce items 1) to 7) above; and
9. items specifically designed to measure, test, evaluate and examine items 1) to 7) above.

Our Key Observations

1. Regulatory changes affecting importers and exporters

Prior to the advent of the Export Control Law and the Encryption Announcement, the import and export of encryption items in China were administered by the SCA. Specifically, importers and exporters of encryption items were required to apply with the SCA or its local (provincial, regional or municipal) counterparts for the “Encryption Products and Equipment Containing Cryptographic Technology Import License” or the “Commercial Encryption Product Export License.”

After January 1, 2021, the import and export of commercial encryption items will be governed by the Encryption Announcement as well as the applicable laws, in particular the Encryption Law, the Export Control Law and the Customs Law. MOFCOM will become the central authority (though it may consult with SCA and/or GAC) to review and issue the “Import License for Dual-Use Items and Technologies” or the “Export License for Dual-Use Items and Technologies” for the import or export of the commercial encryption items respectively listed in the Encryption Import List or Encryption Export List.

2. Mass-market exception for commercial encryption items

Similar to the mass-market exception in the U.S. export control regulations, China’s new Export Control Law and Encryption Announcement include a mass-market exception. According to Article 28 of the Encryption Law, the commercial encryption contained in or used for mass-market consumer products will not be subject to control upon export from or import to Mainland China.

Although there is no clear definition of what items would qualify for the mass-market exception, SCA’s Encryption Q&As may provide some guidance. Specifically, Question 87 states that “commercial encryption used in mass consumer products” refer to encryption technology implemented in products that the general public can purchase through regular retail channels without restrictions for personal use, and cannot easily change the password function. In Question 87, SCA further indicated that commercial encryption used by mass-market consumer products pose a small and controllable risk to national security and public interests. Excluding commercial encryption used by mass-market consumer products from import and export restrictions would minimize the impact on international trade, which is not only a common practice in the international community, but also in line with China’s existing commercial encryption import and export practices.

3. Liabilities for violation

According to Article 38 of the Encryption Law, violations of the rules for import licensing and export control will be subject to punishment by the relevant departments under the State Council and the GAC. We anticipate that after January 1, 2021, the enforcement agencies on the import and export of commercial encryption will change from the SCA and its local counterparts to MOFCOM and/or GAC and their local counterparts. Also, legal basis for the punishments on violations will be mainly the Encryption Law and the Export Control Law.

In case of serious violations, such as exporting of controlled items without obtaining the qualification export operations, exporting controlled items without prior approval and license, exporting controlled items beyond the permitted scope specified in the export license, and/or exporting controlled items that are prohibited from being exported, a fine of up to RMB5 million (about US$758,000) or 10 times the turnover made from the illegal activities may be imposed, together with possible business suspension and revocation of export business qualification. In case of other violations, such as obtaining the export license of controlled items by fraud, bribery or other improper means, or illegally transferring the export license of controlled items, the authorities shall withdraw the approval and revoke the export license, confiscate any illegal income, and impose a fine that is greater than five times and less than 10 times the illegal turnover if the illegal turnover is more than RMB200,000 (about US$30,300). If there is no illegal turnover or the illegal turnover is less than RMB200,000, a fine ranging from RMB200,000 to RMB2 million (about US$303,030) will be imposed.

Businesses engaged in the import or export of commercial encryption items listed in the Encryption Announcement must obtain the appropriate license for the import or export of encryption items.

Conclusion

Multinational companies engaging in import or export in China should identify items that may be subject to import licensing or export control discussed in this alert. We will keep monitoring and advising clients of any development in China’s import and export regulatory regime.